esploradati.istat.it

Context

esploradati.istat.it is the portal for interactive access to the statistical data of Italy’s National Institute of Statistics (ISTAT). It is a React application for viewing datasets with a mapping module. The capture shows 82 requests to only two domains: the portal itself and one external CDN. The policy correctly names ISTAT itself as the data controller. The capture, like the whole series, was taken on a clean Edge browser with no VPN and no blocker. This is another of those rare cases where comparing the document with the fact gives an almost complete match. So, as in similar clean cases, the analysis is mainly about what is done right — and about one small catch.

Was there a consent banner

There is no banner, and this is lawful. On the site there are only technical cookies and pseudonymised analytics on its own infrastructure, without profiling cookies. There is nothing to ask consent for, so no banner is needed. Its absence here is natural, not an oversight.

The policy is precise down to the byte

Here credit is due directly and in detail, because such a thing is not often encountered. The policy names both analytics tools — Matomo and Dynatrace — and describes their privacy configuration down to the byte: in one, the last two bytes of the IP address are zeroed on masking, in the other, the last one. It states that no profiling is conducted, that the data is pseudonymised, and that navigation data is stored no longer than ninety days. This is one of the most specific and honest documents in the whole series — it does not get by with general words, but describes exactly what is technically configured.

What the capture showed

The picture corresponds. The whole site runs on its own domain, the fonts are self-hosted (not loaded from Google, unlike a number of other government sites). Not a single cookie was set throughout the entire session. Of the declared pair of tools, one actually fired in this capture — Dynatrace: its agent loaded immediately, and the telemetry went out later, as the user worked with the data. This is consistent with the description — first-party monitoring with a masked IP. Here is an honest correction: Matomo, although declared in the policy, did not fire in this particular capture — no requests to it were recorded. This does not mean it is absent altogether: it may not have launched on this page of the application or in this scenario. But to claim that «both tools fired» cannot be done from this capture — only Dynatrace fired.

The only catch — an external CDN

And here is the only discrepancy with the document. One JS library — the CSS preprocessor less — is loaded not from its own server, but from a third-party CDN. This is two requests throughout the whole session, and it is not a tracker in the behavioural sense: the library tracks nothing. But formally, when it loads, the visitor’s IP address goes to a third-party service that is not named in the policy by a single word. The catch is minimal, and eliminated trivially — exactly as ISTAT has already handled the fonts: it is enough to place the library on its own server, and the last outward request disappears.

What cannot be claimed from the capture

A few honest caveats. As stated, the absence of Matomo in this capture does not prove it does not work in other scenarios — I record only that in this session it was not called. The content of the Dynatrace telemetry goes out in the request body, which is not preserved in the lightweight export, so on the IP masking I rely on the policy text — and it is consistent with there being no cookie and no persistent identifier. The capture covers one page of the application; the exact server IP addresses are absent from the export.

Conclusion

This is one of the cleanest sites in the series, on a par with the best. The policy is specific down to the byte and matches reality, the analytics is first-party and pseudonymised, there is no profiling, cookies are not set, the fonts are self-hosted, the controller is named correctly, there are no false promises about non-transfer abroad. The only thing that stands out is one utility library pulled from a third-party CDN not named in the document. Against the backdrop of sites that leaked visitors to Google and Meta, this is the difference between an almost impeccable execution and a single minor shortcoming. The main takeaway for the reader: this is what a site that handles a visitor’s data honestly looks like — and one unclosed trifle here only underscores the general order.